On Mon, May 21, 2012 20:25, Roland McGrath wrote:> From a security perspective I think the natural expectation would be that> the seccomp check is on the values that will actually be used, without an> intervening opportunity to change anything.

Actually, considering a tracer has full control over a traced process,it would make most sense from a security perspective to check both thetraced task's seccomp filter, as well as the one for the ptracer formodified system calls (calls where any register poking at all was done).Otherwise a task could bypass its own seccomp filter by ptracing a haplessvictim.

I mentioned this before, but I forgot why this option was dismissed.Probably because ptrace shouldn't have been allowed by the filter inthe first place.

The current patch does the seccomp check first and ignores any changesmade via ptrace, just like the old seccomp did. So in that sense nothingchanged.

Originally the seccomp filter check was in the fast path, so doing itafter ptrace was tricky. But now it has been moved to the slow tracehookpath it can easily be checked after the ptrace notification. That wouldchange the behaviour SECCOMP_MODE=1 though, but probably nobody cares,as it can be argued that that was a security hole anyway (except ifptracing a seccomped task was disallowed, in which case moving it tothe end doesn't change anything anyway).

Another argument for moving it to the end is that it makes debuggingseccomped tasks a lot easier, because the debugger sees the deniedsystem call. With the current patch the tasks would silently die.